Privacy policy

1. Who we are and how to contact us

DeXMI is an AI agent for people who work in mining, created with the support of Optimum Geotechnics, a geotechnical engineering consultancy. In this policy, "DeXMI", "we", "us" and "our" mean DeXMI Pty Ltd (ACN 701 953 764).

This policy covers our website and the DeXMI app. DeXMI Data Core, at data-core.dexmi.ai, is a separate product with its own sign-in. This policy covers only what the DeXMI app exchanges with Data Core when a customer connects the two.

If you use DeXMI through your employer, please also read "Customer content" at the end of this policy.

To contact us:

• Privacy questions, requests and complaints: privacy@dexmi.ai
• Help with the app: support@dexmi.ai
• Security vulnerabilities: security@dexmi.ai (see www.dexmi.ai/security)

2. What personal information we collect

Website visitors and walkthrough requests

When you browse our website. Like any website, our servers and load balancer record some technical details of each request: your IP address, the page you asked for, the time, and the browser details your browser sends (its "user agent"). We use these records to keep the site secure and working. We don't use analytics, advertising or tracking tools.

If you type dexmi.ai without "www". Our domain registrar, GoDaddy, answers that address and redirects you to www.dexmi.ai. Its servers see the same technical details of that one request, and it sets its own cookie on dexmi.ai (see section 8).

When you ask for a walkthrough. The form asks for:

• your name;
• your work email address;
• your company or mine site; and
• if you choose, your role, which product interests you (DeXMI, DeXMI Data Core or both), and what you'd like to see.

We don't store your IP address with your request. We store a scrambled, one-way version of it (a salted hash), which lets us spot abuse, such as repeated automated submissions, without keeping the address itself. To limit floods of submissions, we also keep a count of recent submissions from your IP address for up to an hour. The form has a hidden field that only automated programs fill in. If it is filled in, we store nothing.

When you email us. We receive your email address and anything you choose to include.

People who use the DeXMI app

We provide DeXMI to companies (our customers). If you use DeXMI, an administrator set up your access, usually someone at your company. We collect:

• Account details: your first and last name, work email address, the company you belong to, the roles you've been given, whether your account is active, and when you last signed in and were last active. We never store your password itself, only a one-way (bcrypt) hash of it. The links in activation and password-reset emails are also stored only in hashed form.
• Sign-in and security records: successful and failed sign-ins, sign-outs, password changes and resets, temporary lockouts, and changes administrators make to your account. Sign-in records include the IP address and browser details of the device you used.
• Content you put into DeXMI, and what it produces for you: documents you upload, your questions and chat messages, files you attach, the agent's answers and the steps it took, and the risk assessments, document reviews, workflows and files you create with it. We call all of this customer content (see "Customer content" below).
• Usage records: which features were used, when, and whether they worked, for example "a document was uploaded" or "an answer finished". These records never contain the text of your questions, documents or answers, and they identify you only by an internal user number. We also record each AI request made for you (the model used, the amount of text processed and its cost), so your company can manage its AI budget. And we keep a record of each email we send you: the address, subject, time and whether it was sent.
• Feedback: if your company has feedback capture switched on and you flag an answer as wrong, we keep your note and a copy of that conversation.
• Data Core connections: if your company connects DeXMI to DeXMI Data Core, we keep the connection's access token (encrypted). We also keep records of the files the agent sent to Data Core and of the changes it proposed.

We don't ask for sensitive information, such as health information. Please don't put sensitive information about yourself or anyone else into DeXMI unless your company has decided it needs to be there.

Staying anonymous. You can read our website without telling us who you are. To arrange a walkthrough we need your name and a way to reach you. To use the app you need an account in your own name, because DeXMI keeps a record of who did what.

3. How we collect it

We collect personal information:

• from you, when you fill in the walkthrough form, email us or use the app;
• from your company, when an administrator creates your account, or when your colleagues upload documents that mention you;
• automatically, through server logs, sign-in records, usage records and the cookies described in section 8; and
• from DeXMI Data Core, when your company has connected it and the agent reads Data Core records to answer a question.

4. Why we use it

We use personal information to:

• Arrange your walkthrough. Your request is stored, and emailed to our team. A member of the team reads it and contacts you, usually within one business day. We don't add you to mailing lists and we never sell your details.
• Provide the app. We create and manage accounts, sign you in, run the AI agent on your company's documents and data, and show each answer with its sources.
• Keep DeXMI secure. We limit repeated requests and sign-in attempts, and lock accounts temporarily after repeated failed sign-ins. We also detect stolen sessions, scan uploaded files for malware, investigate problems and keep audit records.
• Contact you about your account and the service. We send invitations, activation links and password resets, and notices about the service, such as planned maintenance or changes to features. These are service messages, not marketing. If we ever send you marketing, you'll be able to opt out of it.
• Run and improve DeXMI. We look at which features are used (from usage records, which contain no content), manage AI costs and fix problems. If your company has feedback capture switched on, our engineers use the conversations people flag to find and fix what went wrong. This can include running a flagged question through the AI again.
• Meet our legal obligations.

AI and your content. We never use customer content to train AI models, and one company's content never shapes the answers another company gets. We don't fine-tune AI models on customer data, and the providers that run the models for us don't train on it either: AWS Bedrock doesn't store the text it processes or use it to train models, and OpenAI doesn't train on what we send it. OpenAI can keep that text for up to 30 days to check for abuse, then deletes it.

Automated decisions. DeXMI helps people search, draft and analyse. It doesn't make decisions about individuals. Its drafts, such as a job safety analysis (JSA), stay drafts until a competent person accepts them.

5. Who we disclose it to

Your company. If you use DeXMI through your employer, your company's administrators can manage your account. They can also see:

• content saved to shared company areas, such as the company knowledge base, shared workflows and risk assessments; and
• any conversations that people flag through feedback capture.

Otherwise, only you can see your chat conversations in the app. When a customer leaves DeXMI, we can give it a copy of its data, including its users' conversations.

Service providers. We use the providers below to run DeXMI. They handle personal information only to provide their service to us.

No other AI provider handles customer data to run DeXMI. If that changes, we'll update this policy first (section 11).

Our team's tools. To build and support DeXMI, our team also uses everyday tools for issue tracking and code hosting, and an AI assistant for engineering work. When we investigate a problem, these tools can see the information involved, such as a name or email address in a support request, or the records behind a request that failed. Some of them process information in the United States. The AI assistant is set not to train on our data.

DeXMI Data Core. If your company connects DeXMI to DeXMI Data Core, the agent sends Data Core the requests it needs to answer a question, such as which instruments to look up. It sends files or proposed changes only after a person approves them. Data Core runs in AWS Sydney.

Optimum Geotechnics. DeXMI was created with the support of Optimum Geotechnics, a separate company. Some of the people who answer walkthrough requests and support emails work for it, and some of the accounts DeXMI runs on are held in its name, which we use under the policies and controls this policy describes. It handles personal information only to help us provide DeXMI.

When the law requires it. We may disclose personal information when the law requires or allows it, for example to a regulator or under a court order.

We don't sell personal information, and we don't share it for advertising.

Overseas disclosure

The DeXMI app stores its data in Australia, but some processing happens overseas:

• United States:
  • OpenAI creates search embeddings from document passages and search questions.
  • AWS ranks search results in its us-east-1 region.
  • Brave receives web search queries, if web search is switched on for your company.
  • GoDaddy, our domain registrar, answers requests to dexmi.ai without "www".
  • Some of the tools our team uses to build and support DeXMI process information there (see "Our team's tools" above).
• Our providers may also let their own support staff access data from other countries, as their terms allow.

Before we disclose personal information to an overseas recipient, we take reasonable steps to ensure it handles the information consistently with the APPs, including through our contracts with it.

6. Storage and security

We host DeXMI on AWS in Sydney: the app servers, the database, uploaded files, backups and logs. Documents are converted to text on our own servers there. Our search index is a Qdrant Cloud cluster, also in AWS Sydney.

How we protect personal information:

• Encryption. Our website and app are served only over HTTPS, and personal information is encrypted in transit and at rest. Passwords are stored only as salted hashes, and the credentials we hold for integrations are encrypted.
• Separation between customers. Each company's data is kept separate, and people see only what their role allows.
• Controlled access. Only authorised team members can access our systems, and they sign in with multi-factor authentication. Our staff look at customer content only when they need to: to give support your company asked for, to investigate a problem or a security incident, or to meet a legal obligation.
• Monitoring and backups. We monitor our systems for threats, scan new uploads for malware, keep security audit logs, and back up our data within AWS in Sydney.

No system is perfectly secure. If we suspect a data breach, we contain it and assess it without delay, and within 30 days at most. If a breach of personal information we hold for our own purposes, such as account details or walkthrough requests, is likely to cause serious harm, we'll notify the people affected and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in line with the Notifiable Data Breaches scheme. If a breach affects a customer's content, we'll give that customer an initial notification within 24 hours of confirming it and a detailed report within 72 hours, and support its own assessment and any notification it needs to make.

7. Retention and deletion

We keep personal information only as long as we need it for the purposes in section 4, or as the law requires. After that, we delete it or de-identify it.

We also keep sign-in and account records, records of AI use and records of the emails we send, as security and account records. You can ask us about them (section 9).

What deleting does:

• Deleting a document removes the file (with all its stored versions), its entries in the search index and its database record.
• Deleting a conversation removes its messages and attachments, the files the agent made in it, and its search index entries.
• Deleting a document review removes the review, its findings and the uploaded procedure.
• If someone flagged a conversation through feedback capture, the flagged copy stays after the conversation is deleted, so we can fix what went wrong.
• Records of files the agent sent to DeXMI Data Core, and of changes it proposed, stay as an audit trail after the conversation is deleted.
• Deleted information can stay in backups for up to 30 days, until those backups expire.

8. Cookies and similar technologies

Our public pages set no cookies and load no scripts or fonts from other companies. The one exception comes before you reach them: if you type dexmi.ai without "www", our domain registrar's redirect sets its own cookie, _tccl_visitor, on dexmi.ai. We don't use it.

The DeXMI app uses three cookies, all strictly necessary to keep you signed in securely. They're set only when you sign in, they're sent only to www.dexmi.ai (no other site or subdomain), and only over HTTPS:

However active you are, you'll need to sign in again after 30 days. Signing out deletes all three cookies.

Your browser's storage. The app keeps display preferences in your browser's local storage, such as light or dark theme, panel widths, folder view and column choices. It keeps the conversation you have open in session storage, which your browser clears when you close the tab. This information stays in your browser and isn't used to track you.

9. Access and correction

You can ask for a copy of the personal information we hold about you, and ask us to correct it. You can change your name yourself in the app. For other changes, ask your company's administrator or contact us (section 1). You can also ask us to delete your personal information (see section 7).

We'll confirm your identity before we act on a request, and we'll respond within 30 days. Making a request, and getting a copy, is free. If the request is about customer content that your company controls, we may refer it to your company and help it respond. If we refuse a request, we'll tell you why in writing and how to complain.

10. Complaints

If you're concerned about how we've handled personal information, please contact us first (section 1). We'll acknowledge your complaint within five business days, and respond within 30 days.

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

• online: www.oaic.gov.au
• phone: 1300 363 992

11. Changes to this policy

We'll update this policy when our practices change, for example when we add a service provider or process data in a new country. The date at the top shows when it last changed. If a change affects customer content, such as a new service provider that receives it, we'll tell our customers' administrators at least 30 days before it takes effect.

Customer content

Our customers decide what goes into DeXMI. Each customer company chooses:

• which documents to upload;
• who can use DeXMI, and what each person can see; and
• whether to connect DeXMI Data Core.

Optional features, such as web search, code execution and feedback capture, are switched on for a company only after it agrees; our team makes the change.

Customer content often includes personal information about people other than the user, such as names in procedures, incident reports or sign-off records. We handle customer content only to provide DeXMI to the customer, under our agreement with it and as this policy describes. We don't use it for anything else, and we never use it to train AI models.

If your question is about personal information in a customer's content, please contact that customer first. We'll help it respond.